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DETAILED ACTION 

Response to Amendment 

1 . The Applicant's amendment, filed 06 December 2007, has been received, 
entered into the record, and respectfully and fully considered. 

2. As a result of the amendment, claims 1 -2, 5-6, 1 7-1 8, 21-22, 30 and 32 have 
been amended. Claim 31 has been cancelled. Claims 33-34 are newly added claims. 
Claims 15-16 are withdrawn from consideration. Therefore, claims 1-14, 17-30 and 32- 
34 are now presented for examination. 

3. Any objections or rejections not repeated below for record are withdrawn due to 
Applicant's amendment. 

Admitted Prior Art 

4. The examiner is aware of Applicant's Admitted Prior Art on pages 1 -3 of the 
Applicant's original disclosure. 

Specification 

5. The examiner acknowledges that the Applicant deletes "or c). . .signaling in a 
carrier wave" on page 16. 

Claim Rejections - 35 USC § 101 

6. 35 U.S.C. 101 reads as follows: 



Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 



Application/Control Number: 10/784,587 Page 3 

Art Unit: 2135 

7. Claims 1-14, 17-30 and 32 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 

Claims 1-14 are directed to a method of tracking incoming transmissions. The 
examiner respectfully asserts that the claimed subject matter does not fall within the 
statutory classes listed in 35 USC 101 . The claimed steps do not result in a tangible 
result. Claims 1-14 are rejected as being directed to an abstract idea (i.e., producing 
non-tangible result) [tangible requirement does require that the claim must recite more 
than a 101 judicial exception, in that the process must set forth a practical application of 
that 101 judicial exception to produce a real-world result, Benson, 409 U.S. at 71-72, 
175 USPQ at 676-77). 

Claims 17-29 and 32 are directed to a data communication device for tracking 
incoming transmissions. However, it appears that the device would reasonably be 
interpreted by one of ordinary skill in the art as software, per se. There is no element 
positively recited as part of the device. Applicant's specification provides no explicit and 
deliberate definition of any positive element, and it appears that such would reasonably 
be interpreted as representative of the software. As such, it believed that the device of 
claims 17-29 and 32 are reasonably interpreted as functional descriptive material, per 
se. 

Claim 30 is directed to a computer program product having a computer readable 
medium operable to store computer program logic. The examiner respectfully asserts 
that the claimed subject matter does not fall within the statutory classes listed in 35 USC 
1 01 . The claimed computer code does not result in a tangible result. Claim 30 is 
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rejected as being directed to a software does not result in a tangible result (i.e., 
producing non-tangible results) [tangible requirement does require that the claim must 
recite more than a 101 judicial exception, in that the process must set forth a practical 
application of that 101 judicial exception to produce a real-world result, Benson, 409 
U.S. at 71-72, 175 USPQ at 676-77). 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

9. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1 0. Claims 1 -3, 5, 9-1 0,14,1 7-1 9, 21 , 25-26, 30 and 32 rejected under 35 
U.S.C. 1 03(a) as being unpatentable over Applicant's Admitted Prior Art in view of 
common knowledge in the art. 

As per claims 1, 17 and 32, Admitted Prior Art discloses a method/data 
communication device of tracking incoming transmissions comprising: 

identifying an incoming transmission including at least one identifiable portion 
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(e.g. page 2, lines 9-21 of the Applicant's Admitted Prior Art); 

computing, for each identifiable portion in the incoming transmission, a 
fingerprint indicative of the identified portion, the fingerprint being substantially unique 
to the identified portion ("The present invention is based, in part, on the observation that 
typical conventional virus diction software monitors incoming arrivals of network traffic" 
- page 3, lines 3-4 of the Applicant's original disclosure and "The conventional virus 
detection application also computes a signature for portions of incoming messages for 
comparison" - e.g. page 2, lines 1 9-20 of the Applicant's original disclosure ); 

receiving a set of comparison fingerprints corresponding to known portions, 
the comparison fingerprints being predetermined ("Such conventional virus detection 
applications, therefore, employ a set of known virus fingerprints for comparison with 
incoming mail messages" - e.g. page 2, lines 22-25 of the Applicant's original 
disclosure); and 

comparing the stored fingerprints to the comparison fingerprints to identify 
stored fingerprints matching comparison fingerprints and, if a match is found, identifying 
the previous incoming transmission corresponding to the matching stored fingerprint 
("...Conventional off-the-shelf (OTS) virus detection software typically scans for such 
undesirable transmission by matching against a set of known harmful transmissions. 
Typically, such conventional matching includes comparing a signature or other 
digital artifact... therefore, employ a set of known virus fingerprints for comparison with 
incoming mail message..." - e.g. page 2, lines 9-25 of the Applicant's original 
disclosure). 
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Although the Admitted Prior Art does not expressly disclose storing the computed 
fingerprint to generate a set of stored fingerprints, the Admitted Prior Art discloses on 
page 2, lines 22-27, "Such conventional virus detection applications, therefore, employs 
a set of known virus fingerprints for comparing with incoming mail messages. The set 
contains a fingerprint for each known virus which the application is to protect against, 
and the application compares each fingerprint in the set to suspect message portions. 
Typically, vendors of such conventional virus detection applications provide periodic 
updates including additions to the fingerprint set of known virus". It is common 
knowledge in the art that in order to compare a set of fingerprints computed from a 
message against a set of fingerprints stored in the database or repository and in order 
to periodic updates to the fingerprint set of known virus, the computed fingerprints at 
least have to be stored in a temporary buffer or storage prior to comparison and 
updates. It would have been obvious to a person with ordinary skill in the art at the time 
of invention that storing the computed fingerprint to generate a set of stored fingerprint 
in order to be compared against/update the fingerprints stored in the database or 
repository. 

As per claims 2 and 18, Admitted Prior Art further discloses wherein storing 
further comprises selectively storing, if the incoming transmission does not correspond 
to the comparison fingerprints, at least one fingerprint corresponding to the identifiable 
portions of the incoming transmission (e.g. page 2, lines 19-21 of the Applicant's original 
disclosure). 
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As per claims 3 and 19, Admitted Prior Art further discloses wherein computing 
the fingerprint value includes determining a signature and comparing comprises 
signature matching (e.g. page 2, lines 22-25 of the Applicant's original disclosure). 

As per claims 5 and 21 , Admitted Prior Art further discloses wherein the 
comparison fingerprints are virus signatures computed from known undesirable 
transactions (e.g. page 2, lines 22-25 of the Applicant's original disclosure). 

As per claims 9 and 25, Admitted Prior Art further discloses wherein the 
determined undesirable portion did not indicate undesirable transmissions based on the 
comparing of a previous set of comparison fingerprints (e.g. page 2, lines 19-25). 

As per claims 10 and 26, Admitted Prior Art further discloses comprising 
demarcating the incoming transmission into segments, each segment operable to yield 
a fingerprint, wherein comparing further comprises comparing each value in the set of 
comparison fingerprints with at least one of the segments (e.g. page 2, lines 19-25). 

As per claim 14, Admitted Prior Art further discloses wherein the undesirable 
portions are selected from the group virus, worms and Trojan horses included as an 
attachment according to an established mail protocol (e.g. page 1, lines 4-5 and page 2, 
lines 9-13) 

As per claim 30, Admitted Prior Art and common knowledge in the art discloses 
the claimed method of steps as applied above in claim 1 . Therefore, Admitted Prior Art 
and common knowledge in the art discloses the claimed computer program/computer 
data signal for carrying out the method of steps. 
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1 1 . Claims 4, 6-8, 11-13, 20, 22-24 and 27-29 are rejected under 35 U.S.C. 1 03(a) 
as being unpatentable over Admitted Prior Art and common knowledge in the art as 
applied to claims 1 and 17 above, and further in view of Paul (U.S. Patent No. 
6,052,709). 

As per claims 4 and 20, Admitted Prior Art - common knowledge further 
discloses comprising receiving at least one successive set of comparison fingerprints, 
and iteratively comparing the successive sets of comparison fingerprints to the stored 
fingerprints (page 2, lines 19-25 of the Applicant's original disclosure). 

Admitted Prior Art - common knowledge in the art do not expressly discloses 
wherein if a match is found, identifying a distribution set of the incoming message 
corresponding to the matching stored fingerprint and transmitting an indication of the 
match to the distribution set. 

Paul discloses wherein if a match is found, identifying a distribution set of the 
incoming message corresponding to the matching stored fingerprint and transmitting an 
indication of the match to the distribution set (abstract, col. 1, line 61 - col. 2, line 24, 
col. 4, line 35 - col. 5, line 9). 

It would have been obvious to a person with ordinary skill in the art to combine 
Paul's wherein if a match is found, identifying a distribution set of the incoming message 
corresponding to the matching stored fingerprint and transmitting an indication of the 
match to the distribution set with Admitted Prior Art - common knowledge in the art 
motivated by "there is a need for a system that automatically and efficiently identifies 
unsolicited e-mails messages and controls the delivery of these messages to users... by 
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preventing delivery of the messages to the user's in-boxes", as disclosed by Paul (col. 
1, lines 41 -49) 

As per claims 6 and 22, Paul further discloses comprising 
storing an indication of the subsequent disposition of the incoming transmission; 
receiving a subsequent set of comparison fingerprints, the subsequent set 
indicative of refinements to the known portions; matching the subsequent set to the 
stored fingerprints; determining, based on the matching of the subsequent set, if the 
subsequent set of comparison fingerprint is indicative of an undesirable portion in the 
incoming transmission; and selectively performing, based on the determining, a 
remedial action in response to the subsequent disposition (e.g. col. 5, lines 1-32, col. 5, 
line 56 -col. 6, line 16, col. 6, line 64 -col. 7, line 1). 

As per claims 7 and 23, Paul further discloses wherein the subsequent 
disposition includes transmitting the incoming transmission to a list of successive 
recipients; and the remedial action is sending a notification to the successive recipients 
indicative of the matching incoming transmission (e.g. abstract). 

As per claims 8 and 24, Admitted Prior Art - common knowledge in the art - 
Paul further discloses wherein the incoming transmission further comprises a series of 
potentially harmful network transmissions, each of the incoming transmission operable 
to include malicious code, wherein the subsequent disposition includes delivery to at 
least one successive recipient and remedial action includes determining the successive 
recipients from the stored successive disposition and notifying each of the successive 
recipients (Paul, abstract; Admitted Prior art - page 2, lines 19-25). 
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As per claims 11 and 27, Paul further discloses comprising identifying a 
segment type of each segment, the segment type corresponding to the content included 
in the segment; and categorizing each of the segments according to a heuristic, the 
heuristic indicative of a likelihood of the categorized segment including an undesirable 
transmission (e.g. col. 7, lines 37-54). 

As per claims 12 and 28, Admitted Prior Art - Paul further discloses comprising: 
identifying a risk assessment of each of the segment types and storing the segment 
according to the identified risk assessment, storing further including identifying a 
duration (e.g. Paul - col. 7, lines 37-54 and Admitted Prior Art - e.g. page 2, lines 19- 
27). 

As per claims 13 and 29, Admitted Prior Art -common knowledge in the art 
further discloses wherein storing the segments further comprises storing the content of 
the segment with the corresponding fingerprint (page 2, lines 19-25 of the Applicant's 
original disclosure and it is well known in the art that storing the content of the segment 
with the corresponding fingerprint in order to avoid storage duplications) 
12. Claims 33 and 34 rejected under 35 U.S.C. 103(a) as being unpatentable over 
Admitted Prior Art -common knowledge in the art as applied to claims 1 and 17 above, 
and further in view of Van der Made (U.S. Pub. No. 20030212902). 

As per claims 33 and 34, Admitted Prior Art -common knowledge in the art does 
not expressly disclose identifying a previous incoming transmission is a retroactive 
analysis of a previously accepted transmission. 
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Van der Made discloses identifying a previous incoming transmission is a 
retroactive analysis of a previously accepted transmission ("Most preferably, each time 
a new program is analyzed a new instance of the AVPE is generated, free of 
modification by any previously virtualized programs including any earlier analyzed 
viruses... setting bits in the behavior pattern register according to the observed 
behaviors. It is these bits in the behavior pattern that are retained after the simulation is 
complete... The bits stored in the behavior pattern register are the behavior pattern and 
subsequent analysis indicates whether the virtually executed program includes 
behaviors indicative of the presence of a virus or other malignant code. . . ." - e.g. par. 
[0037]) 

It would have been obvious to a person with ordinary skill in the art at the time of 
the invention to incorporate Van der Made's identifying a previous incoming 
transmission is a retroactive analysis of a previously accepted transmission into 
Admitted Prior Art -common knowledge in the art motivated by improving techniques for 
detecting virus and other malicious types of code are desirable (e.g. Van der Made, 
paragraph [0013]) in order to avoid identifying a large number of false positives for P- 
code and N-code programs and to detect all virus or malicious code not previously 
identified and all virus or malicious code created after the update to the signature 
database will be detected (e.g. Van der Made, par. [0005] - [0007]). 

Response to Arguments 
13. Applicant's arguments filed 6 December 2007 have been respectfully and fully 
considered but they are not persuasive. 
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14. Applicant's argument are summarized as: 

a. The Applicant argues, "claim 1 is directed to a method and claim 30 is 
directed to a manufacture, so that the subject matter corresponds to a "process" and a 
"manufacture" respectively as recited in 35 U.S.C. 101 . Therefore, applying the judicial 
exception test "useful, concrete and tangible result" is not an issue for these claims" 
(see Remark pages 12-13), the examiner respectfully disagrees. 

First, Statutory processes are evidenced by physical transformation steps, such 
as chemical, electrical, and mechanical steps. In claim 1, there is no implicit 
transformation of electrical signals from one state to another as happens in a computer. 
The steps do not transform any physical subject matter into a different state or thing. 
Accordingly, the steps in claim 1 do not define a statutory "process" under § 101 using 
the "transformation" test. Second, claim 1 encompasses the abstract idea of plan or 
goal of tracking incoming transmission. Then we need to look a useful, concrete and 
tangible result to establish a practical application. Contrary to Applicant's argument that 
claim 1 that storing the computed fingerprint to generate a set of stored fingerprints is 
useful, concrete and tangible result, the examiner respectfully responds that in 
accordance with the disclosure and knowledge of those of ordinary skill in the art at the 
time of the invention, storing the computed fingerprint to generate a set of stored 
fingerprint is just an abstract concept and there is no tangible result being produced. It 
is nothing but a disembodied "abstract idea" until it is instantiated in some physical way 
so as to become a practical application of the idea. The steps of 
"identifying. ..computing. ..storing. ..to generate.. .receiving. ..and comparing..." merely 
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describe steps or goals in the plan, and do not recite how those steps are implemented 
in some physical way: the steps remain disembodied. Because the steps cover 
("preempt") any and every possible way of performing the steps of the plan, by human 
or any kind of machine or by any combination thereof, the examiner concludes that the 
claim is so broad that it is directed to the "abstract idea" itself, rather than a practical 
implementation of the concept. Further, claim 30 is not directed to a Manufacture within 
the meaning of 101, since it is not an article produced from raw or prepared materials. 
Furthermore, claim 30 is directed to a computer program product having a computer 
readable medium operable to store computer program logic to perform above discussed 
step 1 . Thus, claim 30 is rejected using the same rationale as rejecting claim 1 above. 

b. The Applicant argues, "Claims 17 and 32 have been amended to add "a 
processor comprising... Claims 17 and 32 now recite a combination of hardware and 
software" (see Remark pages 13-14), the examiner respectfully disagrees. 

First, the examiner's position is that a device, processor, server, segmenter, 
repository and comparator can be reasonably interpreted by one of ordinary skill in the 
art as software, i.e. a database, file, or other data structure used for storage, 
connecting, outputting, transmitting and etc. According to "The Authoritative Dictionary 
of IEEE Standards Terms Seventh EDITION", "device (10) (software) A mechanism or 
piece of equipment designed to serve a purpose or perform a function" on page 297, 
"processor (2) (software) A computer program that includes the compiling, assembling, 
translating, and related functions for a specific programming language on page 872, and 
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"server (5) the software component on one device that provides services for use by 
clients on the same or another device" on page 1031 . 

Second, the Applicant did not provide explicit definitions of the terms used in the 
specification (Please see specification pages 9-11). Therefore, the specification does 
not contain any statement instructing one to interpret device, processor, server, 
segmenter, repository and comparator are always referring to hardware, i.e. a 
microprocessor, or a combination of hardware and software rather than software per se. 
"Where an explicit definition is provided by the applicant for a term, that definition will 
control interpretation of the term as it is used in the claim. Toro Co. v. White 
Consolidated Industries Inc., 199 F.3d 1295, 1301, 53 USPQ2d 1065, 1069 (Fed. Cir. 
1999) (meaning of words used in a claim is not construed in a "lexicographic vacuum, 
but in the context of the specification and drawings."). Any special meaning assigned to 
a term "must be sufficiently clear in the specification that any departure from common 
usage would be so understood by a person of experience in the field of the invention." 
Multiform Desiccants Inc. v. Medzam Ltd., 133 F.3d 1473, 1477, 45 USPQ2d 1429, 
1432 (Fed. Cir. 1998). See also MPEP §2111.01." 

c. The Applicant argues, "..the Applicant Admitted Prior Art does not disclose 
identifying a previous incoming transmisstion...and the cited text is silent as to previous 
incoming transmissions, which are different than incoming transmissions" and "it is not 
necessary to store the computed fingerprint in the common art" (See Remark 14-15), 
the examiner respectfully disagrees. 
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First, for example, on page 2, lines 9-25 of the Applicant original disclosure, 
AAPA discloses ("...Conventional off-the-shelf (OTS) virus detection software typically 
scans for such undesirable transmission by matching against a set of known harmful 
transmissions. Typically, such conventional matching includes comparing a 
signature or other digital artifact... therefore, employ a set of known virus fingerprints 
for comparison with incoming mail message...". Please note a set of known harmful 
transmissions correspond to Applicant's previous incoming transmission. 

Second, according to MPEP § 2106, 8 th Ed. Rev. 5, "USPTO personnel are to 
give claims their broadest reasonable interpretation in light of the supporting 
disclosure. In re Morris, 127 F.3d 1048, 1054-55, 44 USPQ2d 1023, 1027-28 (Fed. Cir. 
1997). Limitations appearing in the specification but not recited in the claim 
should not be read into the claim. E-Pass Techs., Inc. v. 3Com Corp., 343 F.3d 1364, 
1369, 67 USPQ2d 1947, 1950 (Fed. Cir. 2003) (claims must be interpreted "in view of 
the specification" without importing limitations from the specification into the claims 
unnecessarily). In re Prater, 415 F.2d 1393, 1404-05, 162 USPQ 541, 550- 551 (CCPA 
1969). See also In re Zletz, 893 F.2d 319, 321-22, 13 USPQ2d 1320,1322 (Fed. Cir. 
1989) ("During patent examination the pending claims must be interpreted as 
broadly as their terms reasonably allow.... The reason is simply that during patent 
prosecution when claims can be amended, ambiguities should be recognized, 
scope and breadth of language explored, and clarification imposed.... An 
essential purpose of patent examination is to fashion claims that are precise, 
clear, correct, and unambiguous. Only in this way can uncertainties of claim 
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scope be removed, as much as possible, during the administrative process."). In 
this case, the Applicant cited page 3 lines 3-10 of the Application, "...previously 
accepted traffic...". However, "previously accepted traffic" in the specification is 
different from "a previous incoming transmission". Therefore, the Applicant is 
respectfully reminded again "Limitations appearing in the specification but not 
recited in the claim should not be read into the claim". 

Third, in order to better explain her position that storing the computed fingerprint 
in the common art, the examiner further explain in the above rejection that on page 2, 
lines 22-27, "Such conventional virus detection applications, therefore, employs a set of 
known virus fingerprints for comparing with incoming mail messages. The set contains 
a fingerprint for each known virus which the application is to protect against, and the 
application compares each fingerprint in the set to suspect message portions. Typically, 
vendors of such conventional virus detection applications provide periodic updates 
including additions to the fingerprint set of known virus". It is common knowledge in the 
art that in order to compare a set of fingerprints computed from a message against a set 
of fingerprints stored in the database or repository and in order to periodic updates to 
the fingerprint set of known virus, the computed fingerprints at least have to be stored in 
a temporary buffer or storage prior to comparison and updates. 

d. The Applicant argues, "Dependent claims are allowable due to 
dependency" (see Remark page 16), the examiner respectfully disagrees. 

In response to argument 'd', the examiner respectfully traverses. Applicant's 
argument for claims 1 , 17, 30 and 32 as discussed above are traversed and therefore, 
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the Applicant's arguments for dependent claims are based on dependency on claims 1 , 
17, 30 and 32 are traversed and it is not allowable. 

e. New dependent claims 33 and 34 are addressed in the above new ground 
rejection. 

Conclusion 

15. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

16. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. In particular, Applicant is strongly urged to review references 
Van der Made (U.S. Patent 7,093,239), Margolus et al. (U.S. Patent 7,124,305), Gibbs 
(U.S. Patent 6,615,348), Leeds (U.S. Patent 6,393,465), Tarbotton et al. (U.S. Patent 
6,757,830), Ji et al. (U.S. Patent 5,889,943), Smithson et al. (U.S. Patent 6,886,099) 
and Jordan (U.S. Patent 7,231 ,667) in response to the current office action. 
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p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
/April Y Shan/ 
Examiner, Art Unit 2135 

/KIMYEN VU/ 
Supervisory Patent Examiner, Art Unit 2135 



